MISP
/
mail_to_misp
mirror of https://github.com/MISP/mail_to_misp
2
0
Fork 0
Code Issues Releases Wiki Activity

optionally add original mail to MISP

pull/4/head
Sascha Rommelfangen 2017-05-31 15:45:53 +02:00
parent 04248958c8
commit 6d3cfc5a49
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
mail_to_misp.py
View File

@ -107,6 +107,7 @@ tlptag_default = config.tlptag_default
stopword = config.stopword
hash_only_tags = config.hash_only_tags
forward_identifiers = config.forward_identifiers
attach_original_mail = config.attach_original_mail
original_email_data = email_data
@ -134,8 +135,8 @@ misp = init(misp_url, misp_key)
new_event = misp.new_event(info=email_subject, distribution=0, threat_level_id=3, analysis=1)
misp.add_tag(new_event, tlp_tag)
#if original_email_data:
# misp.add_named_attribute(new_event, 'email-body', original_email_data.decode('utf-8', 'ignore'), to_ids=False)
if attach_original_mail and original_email_data:
misp.add_named_attribute(new_event, 'email-body', original_email_data, category='Payload delivery', to_ids=False)
# Add additional tags depending on others
for tag in dependingtags:
if tag in tlp_tag:

1
mail_to_misp_config.py-example
View File

@ -8,6 +8,7 @@ misp_verifycert = True
debug = False
nameservers = ['149.13.33.69']
email_subject_prefix = b'M2M - '
attach_original_mail = True
excludelist = ('google.com', 'microsoft.com')
externallist = ('virustotal.com', 'malwr.com', 'hybrid-analysis.com', 'emergingthreats.net')